CVE-2026-64323 Details
Description
In the Linux kernel, the following vulnerability has been resolved: udf: validate VAT header length against the VAT inode size udf_load_vat() takes the virtual partition's start offset straight from the on-disk VAT 2.0 header without checking it against the VAT inode size: map->s_type_specific.s_virtual.s_start_offset = le16_to_cpu(vat20->lengthHeader); map->s_type_specific.s_virtual.s_num_entries = (sbi->s_vat_inode->i_size - map->s_type_specific.s_virtual.s_start_offset) >> 2; lengthHeader is a fully attacker-controlled 16-bit value. If it exceeds the VAT inode size, the s_num_entries subtraction underflows to a huge count, which defeats the "block > s_num_entries" bound in udf_get_pblock_virt15(); and on the ICB-inline path that function reads ((__le32 *)(iinfo->i_data + s_start_offset))[block] so a large s_start_offset indexes past the inode's in-ICB data. Mounting a crafted UDF image with a virtual (VAT) partition then triggers an out-of-bounds read. Reject a VAT whose header length does not leave room for at least one entry within the VAT inode.
A vulnerability in the Linux kernel's UDF (Universal Disk Format) handling has been identified, specifically within the virtual partition management of VAT (Virtual Allocation Table) 2.0 headers. The issue arises because the UDF loader directly uses a 16-bit header length value from the VAT header to determine the starting offset of the virtual partition, without validating it against the actual size of the VAT inode. This oversight allows an attacker to craft a UDF image that exploits this validation flaw. If the header length exceeds the VAT inode size, it causes an underflow in the calculation of the number of entries, bypassing a crucial boundary check. Consequently, the system can read data beyond the inode's allocated buffer, leading to an out-of-bounds memory access. This vulnerability can be triggered by mounting a specially crafted UDF image that includes a virtual partition with a manipulated header length.
The vulnerability has been addressed in the official Linux Git repository. Users can upgrade to the latest version of the Linux kernel to apply the fix.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
No SSVC data is available for this CVE.
References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://git.kernel.org/stable/c/0ad2d09a8d66fa8dc6f9b70d660b5fb4478ea934 | kernel.org | Patch |
| https://git.kernel.org/stable/c/2900e02a0dd4fc30ac9840e7ce4ca0b041ab0d63 | kernel.org | Patch |
| https://git.kernel.org/stable/c/55287a3555ff0515b3aff181d2c08c0462a41709 | kernel.org | Patch |
| https://git.kernel.org/stable/c/74580fdf022909e184223cacc364feb826982d96 | kernel.org | Patch |
| https://git.kernel.org/stable/c/883962731420ec271ed8c1cd76524f4b17faa982 | kernel.org | Patch |
| https://git.kernel.org/stable/c/bb0d384c1f42a5b7ace0bd88fee80b9bb1d49acb | kernel.org | Patch |
| https://git.kernel.org/stable/c/d8202786b3d75125c84ebc4de6d946f92fde0ee8 | kernel.org | Patch |
| https://git.kernel.org/stable/c/e610fb113cdfa8bf4247c9bf4f2337b81ad4ddad | kernel.org | Patch |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-787 | Out-of-bounds Write | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| linux linux kernel | >= 2.6.26, < 5.10.261 >= 5.11, < 5.15.212 >= 5.16, < 6.1.178 >= 6.2, < 6.6.145 >= 6.7, < 6.12.96 >= 6.13, < 6.18.39 >= 6.19, < 7.1.4 |
CPE
Remediation
| |
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Sep 4, 2026 | Initial Analysis | [email protected] |
| Aug 17, 2026 | CVE Modified | kernel.org |
| Jul 27, 2026 | CVE Modified | kernel.org |
| Jul 25, 2026 | New CVE Received | kernel.org |